Analysis

  • max time kernel
    46s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    12-06-2024 13:20

General

  • Target

    f363689df11b1848a39c585c04c9e6034384a037776004a7f34fec493ae38765.apk

  • Size

    3.2MB

  • MD5

    9f5e01cc2a0c2206b418ba95eb63fe00

  • SHA1

    fcb06082ba471b6cb4817d5dab2a28f0cd63df9f

  • SHA256

    f363689df11b1848a39c585c04c9e6034384a037776004a7f34fec493ae38765

  • SHA512

    130830d5e7efe7918fbbae980dc3531267c2bd3c0afc8f57378a2c586de77cec7cc79d8cfd003bfb5e68b9db6d58d1d318c655cc031efcec6d6f03bd66a792a0

  • SSDEEP

    98304:8Op8N9EDEcsrf+tfjktkVK2nJlhOrNHCA:dhsrGZjkqnJDA

Malware Config

Signatures

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • yes.debug.yesbnak
    1⤵
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4270

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/yes.debug.yesbnak/files/profileInstalled
    Filesize

    24B

    MD5

    f73b5523ebbe7cb1205f1dd635802931

    SHA1

    e62bb4776ec278b43ed503cdde4a81ffb62dd830

    SHA256

    94289929de3f2e26bab01c994c03e9359bb51787d2cce6c5371bdb1fab004073

    SHA512

    ed7825f7a06815c3802dcdb68c63992324c286949551a2e69fe9f4300e190e078b8399d2485a7135cf766f0f57f40da10156f85c7e0ef93438be8580bcedcb2a

  • /data/data/yes.debug.yesbnak/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    b3b792f790a972b96a41639f150cc98b

    SHA1

    ba243a6f4eb994e82e72b34dc58d436bbd173353

    SHA256

    3a07573b62e67d79fe312b51bda5d9dcb062022c81ccf7f7ea5806deaf54e6d3

    SHA512

    c2a32d8caaa75dd7e67a58a8d9f1280a866f1ed96fa7b13f3e09cbd6656e69653a0c57ab78f838557d877490250c520ffc64bfd8353a4f3d1af99f9c5ddab7cd

  • /data/misc/profiles/cur/0/yes.debug.yesbnak/primary.prof
    Filesize

    1KB

    MD5

    db5bc98d7b015767d8f585a53d714c16

    SHA1

    52f1d6ebd0ab4271bf3c80df7a02f8b43e37ee1a

    SHA256

    ddcc9451e13adb14ea8dc278406318468cab2109b8dcb0d20c63eac98bbf97e1

    SHA512

    cbb230a50cc4011a05b60bb28ef406c443a4554bd615acb447d167a521389c5479402316751a061ff437877c575ff2ad8ca2e2032da53dec20e41ad2250e3bd7

  • /data/misc/profiles/cur/0/yes.debug.yesbnak/primary.prof
    Filesize

    3KB

    MD5

    90c57992c3b15dca4a2f78fabe8a512f

    SHA1

    52f0e77c11e4357a6a0625e8e37daf29b1f2410b

    SHA256

    213623c069f0b0615f2e25815b3e8167073896789a0a4c4d072ccc23255d55e7

    SHA512

    21f5944cbe9d523e926c09615f65bf13efb866f2b6e298d84b700d7d582bd2c2954d19b5309fcc4254bb5ae074bad8abfd73d9bdd0b2d1efbb6b0ea5a4cdf33d